AIKIDO-2026-10230

TL;DR

Affected versions of this package contain an unsafe memory management vulnerability in the tcp_stream function, where a raw pointer is incorrectly treated as an independently heap-allocated TcpStream when it actually lives inline within a wrapper struct, leading to undefined behavior via double-free or heap corruption upon deallocation. An attacker who can influence the timing or frequency of TCP connection handling could potentially exploit this by triggering repeated connection teardowns, causing heap metadata corruption that may lead to denial of service or, in advanced scenarios, controlled memory overwrites that could be leveraged for arbitrary code execution.